Board

North Korea is “systematically” violating international sanctions by stealing cryptocurrency and using the proceeds to purchase weapons, according to sanctions monitors from 11 countries, finding that Pyongyang’s “full-spectrum” cyber program rivals those of China and Russia.

The Multilateral Sanctions Monitoring Team (MSMT), envisioned as a replacement for the disbanded U.N. Panel of Experts, released its second report on Wednesday documenting the DPRK’s efforts to raise revenue for its nuclear and missile programs through illicit cyber operations and IT worker deployments.

The report states that North Korea stole a total of $2.84 billion in virtual assets from between Jan. 2024 to Sept. 2025, using a variety of cryptocurrency services to launder its ill-gotten gains and convert it to cash. The estimate broadly aligns with figures provided by other blockchain analysts.

The DPRK relies on globally dispersed networks of North Koreans and “foreign-based facilitators” to carry out these cyber operations, according to the report, particularly in China but also Russia, Argentina, Cambodia, Vietnam and the UAE.

MSMT states that DPRK uses the proceeds to trade for weapons, gold, copper and other raw materials prohibited under U.N. Security Council (UNSC) resolutions.

Kwak Jin, a cybersecurity professor at Ajou University, told NK News that cryptocurrency theft is key to Pongyang’s strategy to generate revenue through “high‑risk, high‑return operations.”

“Since North Korea is heavily restricted by economic sanctions, cybercrime has now become a central source of income for the country,” the expert said, noting that stolen cryptocurrency accounted for roughly one-third of the country’s total foreign currency earnings last year.

Beyond cryptocurrency theft, the report drew attention to North Korea’s strategy of deploying IT workers to work remotely at foreign firms to earn money for the regime.

Some 1,000 to 2,000 DPRK IT workers live in countries including China, Russia and Laos, according to MNMT. They earned an estimated $350 million to $800 million last year by taking on projects in AI, website development and other fields, with half sent back to the DPRK.

These workers belong to subunits of U.N.-sanctioned entities such as the Reconnaissance General Bureau and the Ministry of Atomic Energy Industry, according to the report.

“Following the recent U.S. government-led crackdown of DPRK IT workers operating in U.S. jurisdictions, 220 these workers have expanded the scope of their operations globally, with a particular focus on seeking employment at small- and medium-sized European IT firms,” the report stated.

It added that facilitators in third countries such as China, Russia, Pakistan and Vietnam help these IT workers with identity falsification and money laundering.

In particular, MSMT member states reported that North Korea plans to send 40,000 laborers to Russia, including “several delegations of IT workers.” The report emphasized that this violates UNSC sanctions that require U.N. member states to repatriate all DPRK nationals earning income overseas.

Beyond financial crimes, North Korean cyber actors have also continued to steal sensitive data in attacks on defense companies, seeking information that can support its weapons development, according to the report.

With respect to tactics, the report states that DPRK operatives have posed as investors, businesspeople and recruiters to contact victims and trick them into downloading malicious software.

It also notes that North Korean hacking groups are using more advanced strategies, such as dangling fake job interviews and AI tools like ChatGPT and DeepSeek, to target professionals and jobseekers.

“Existing records, education and even personal background details can be analyzed against the target company’s requirements,” the expert Kwak explained.

To combat DPRK cybercrime, the MSMT laid out 11 recommendations for U.N. member states and the international community, ranging from repatriating North Korean workers to improving oversight of cryptocurrency exchanges.

“We encourage all U.N. member states to raise awareness about the DPRK’s malicious cyber activities and hold responsible parties accountable for UNSCR violations, including through sanctions,” the MSMT said in a joint statement.

It also urged companies to verify IT personnel, limit access to sensitive data and refrain from paying employees in cryptocurrency.

“When you look at how Southeast Asian companies are used for money‑laundering, you can see the problem is global,” the expert Kwak said. “Virtual‑asset exchanges have been hacked in the United Arab Emirates, Japan, India and Singapore, and for those funds to be laundered they inevitably have to move between wallets.”

Launched in October last year, the MSMT is a sanctions monitoring body formed by U.N. member states — including the U.S. and South Korea — in an effort to fill the gap left by the dissolution of the U.N. Panel of Experts on North Korea.

The panel formerly monitored DPRK sanctions enforcement and documented violations in biannual reports, but Russia vetoed the panel’s mandate last year amid its escalating military cooperation with Pyongyang over the war in Ukraine.

MSMT released its first report in May, focusing on North Korea-Russia military cooperation. North Korea’s foreign ministry slammed the report as a “provocative act.”

The 11 MSMT member states are the U.S., South Korea, the U.K. Japan, Australia, Canada, France, Germany, Italy, the Netherlands and New Zealand.

[관련출처: ​NK NEWS]